Executive brief
ImageMagick is a widely used software suite for creating, editing, and converting images. A flaw in its encryption component allows for the potential recovery of original image data from encrypted files. This could lead to the exposure of sensitive visual information that was intended to be protected.
Technical details
An information disclosure vulnerability exists in ImageMagick's PasskeyEncipherImage method (CWE-323). The root cause is the reuse of nonces within the AES-CTR cipher implementation. Because AES-CTR is a stream cipher, reusing a nonce with the same key allows an attacker to perform a XOR operation between two ciphertexts to reveal information about the underlying plaintexts. This vulnerability can be exploited if an attacker gains access to multiple images encrypted with the same parameters. The issue is resolved in versions 7.1.2-22 and 6.9.13-47.
Affected products
- ImageMagick ImageMagick < 7.1.2-22, < 6.9.13-47
Timeline
- 2026-05-16: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: NVD publication date